API Key Security

Do you even need one?

Probably not. Payment links and checkout buttons need no key at all.

You only need an API key if someone is writing code against Brykto. If that is not you, there is nothing to do on this page.

What it is

Your API key lets code create payments as you. It starts with brykto_live_sk_ and lives under Developer Tools in your dashboard.

Treat it exactly like a password. Anyone holding it can create payments in your name.

Keep it out of

• Public code repositories
• Anything that runs in a browser
• Screenshots and support messages
• Log files

Storing it

Keep it in an environment variable on your server rather than written into your source code.

BRYKTO_API_KEY=brykto_live_sk_your_key_here

Rotating it

If it may have been seen by anyone else, replace it straight away.

1. Open Developer Tools in your dashboard.
2. Rotate the key.
3. Update whatever was using it.

The old key stops working the moment you rotate, so have the update ready before you do it.

Your checkout buttons carry no key, so rotating never affects them.